요약
- CVE-2019-17625은(는) rambox (rambox), Rambox에 영향을 주는 심각 (CVSS 9.0) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 3.0%, 전체 취약점의 87.5%보다 높음.
- 아직 패치 버전 정보가 없습니다. 참고 자료의 공급업체 권고를 확인하세요.
| Package | Affected versions | Patched versions |
|---|
| rambox | = 0.6.9
| No fix yet |
| Rambox npm | ≤ 0.6.9
| No fix yet |
Description
There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron, such as an exec of OS commands within the onerror attribute of an IMG element.
NVD description
There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron, such as an exec of OS commands within the onerror attribute of an IMG element.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free